Re: Howto refresh IIS 6 Application pool identity credential info

Ken,

FYI, the results of logonsessions.exe (SysInternals)

Logon session 00000000:0327e6da:
User name: DEV\NfnOUser
Auth package: Kerberos
Logon type: Batch
Session: 0
Sid: S-1-5-21-1275210071-688789844-725345543-4792
Logon time: 7/02/2008 7:58:32
Logon server: DEVDC1
DNS Domain: DEV.DIGANT.ANTWERPEN.LOCAL
UPN:

--- application pool stop/start

Logon session 00000000:0327e6da:
User name: DEV\NfnOUser
Auth package: Kerberos
Logon type: Batch
Session: 0
Sid: S-1-5-21-1275210071-688789844-725345543-4792
Logon time: 7/02/2008 7:58:32
Logon server: DEVDC1
DNS Domain: DEV.DIGANT.ANTWERPEN.LOCAL
UPN:

---> nothing changed


--- IISRESET

Logon session 00000000:04efb566:
User name: DEV\NfnOUser
Auth package: Kerberos
Logon type: Batch
Session: 0
Sid: S-1-5-21-1275210071-688789844-725345543-4792
Logon time: 11/02/2008 7:49:36
Logon server: DEVDC1
DNS Domain: DEV.DIGANT.ANTWERPEN.LOCAL
UPN:

---> new logon session (session ID and logon time)

Grtz,

Peter

"Peke" wrote:

Ken,

Thx for the response, but stopping/starting the application pool doesn't help.
It seems that the domain account security is cached at startup of IIS, and
doesn't change until IISRESET is executed. After IISRESET, I see that the
logon time for the account has changed (using sysinternals tool). An
application pool restart doesn't change the credential info.

FYI,
the sysinternal tool shows that it has an authentication package of type
Kerberos and the logon type is Batch. So I think the solution could be found
in "renewing" the Kerberos ticket, but I have no idea how to do that.

IISRESET does the job so the code is somewhere in there :-(.

Kind regards,
Peter

"Ken Schaefer" wrote:

You should just be able to restart the web application pool in question.

Cheers
Ken


"Peke" <peke@xxxxxxxxxxxxx> wrote in message
news:53EA3347-C41F-42CE-964B-7EF6EA321BCA@xxxxxxxxxxxxxxxx
Hi,

We are having problems with the following situation.

If we change security settings for an application pool identity (something
like putting it in a security group (to have NTFS access on a folder,
accessible through a virtual directory in IIS)), the access is only
granted
after IISRESET. It's a domain account (I don(t know if this is
important.).
It seems like we have the following scenario :
On start of IIS, all application pool identities are given a logon
session.
I can see that using logonsessions.exe from sysinternals.
The logon session is only refreshed/renewed after IISRESET.
Is there a better , less impacting , way to get the specific logon
sesssion
renewed ?

Grtz,

Peter



.

Relevant Pages

  • Re: AppPool + secureConversation
    ... because it has a logon session. ... logon session(no additional interactive logon session exists), then, DPAPI ... Microsoft MSDN Online Support Lead ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Getting a list of logged on users and hosts
    ... Well technicaly all logon sessions are on local machine. ... On DC a network logon session _is_ created for every NT workstation logon. ... >> host of the user on whose behalf LsaLogonSession executes. ... > is always the user of the LSA that is responsible for "remote logon ...
    (microsoft.public.win32.programmer.kernel)
  • Re: Getting a list of logged on users and hosts
    ... Well technicaly all logon sessions are on local machine. ... On DC a network logon session _is_ created for every NT workstation logon. ... >> host of the user on whose behalf LsaLogonSession executes. ... > is always the user of the LSA that is responsible for "remote logon ...
    (microsoft.public.win32.programmer.networks)
  • Re: cant use "NET USE" at windows services
    ... now, everytime after rebooting, i need to logon as a domain user to the ... > Network logon sessions are tied to the windows logon session of the ... this session is private to the windows logon session of the ...
    (microsoft.public.dotnet.languages.csharp)
  • SSPI logon gives handle to existing logon session
    ... I have a problem with code that does a SSPI logon. ... client, but the token I get refers to the same "client" logon session ... I want a new logon session to be created. ... If the client side uses a username password, ...
    (microsoft.public.platformsdk.security)